Overview
overview
7Static
static
7HShield/AhnUpCtl.dll
windows7-x64
1HShield/AhnUpCtl.dll
windows10-2004-x64
1HShield/AhnUpGS.dll
windows7-x64
1HShield/AhnUpGS.dll
windows10-2004-x64
1HShield/AspINet.dll
windows7-x64
1HShield/AspINet.dll
windows10-2004-x64
1HShield/Bz32Ex.dll
windows7-x64
1HShield/Bz32Ex.dll
windows10-2004-x64
1HShield/HSInst.dll
windows7-x64
1HShield/HSInst.dll
windows10-2004-x64
1HShield/HSUpdate.exe
windows7-x64
1HShield/HSUpdate.exe
windows10-2004-x64
1HShield/Ma...ry.exe
windows7-x64
1HShield/Ma...ry.exe
windows10-2004-x64
7HShield/Up...i2.dll
windows7-x64
1HShield/Up...i2.dll
windows10-2004-x64
1HShield/Up...tl.dll
windows7-x64
1HShield/Up...tl.dll
windows10-2004-x64
1HShield/Up...up.exe
windows7-x64
7HShield/Up...up.exe
windows10-2004-x64
7ahnrpt.exe
windows7-x64
7ahnrpt.exe
windows10-2004-x64
7$PLUGINSDI...pt.exe
windows7-x64
7$PLUGINSDI...pt.exe
windows10-2004-x64
7$PLUGINSDI...PI.dll
windows7-x64
3$PLUGINSDI...PI.dll
windows10-2004-x64
3ehsvc.dll
windows7-x64
7ehsvc.dll
windows10-2004-x64
7HShield/Up...32.dll
windows7-x64
1HShield/Up...32.dll
windows10-2004-x64
1HShield/V3Hunt.dll
windows7-x64
3HShield/V3Hunt.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:54
Behavioral task
behavioral1
Sample
HShield/AhnUpCtl.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
HShield/AhnUpCtl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
HShield/AhnUpGS.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
HShield/AhnUpGS.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
HShield/AspINet.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
HShield/AspINet.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
HShield/Bz32Ex.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
HShield/Bz32Ex.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
HShield/HSInst.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
HShield/HSInst.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
HShield/HSUpdate.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
HShield/HSUpdate.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
HShield/MapleStory.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
HShield/MapleStory.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
HShield/Update/ahni2.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
HShield/Update/ahni2.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
HShield/Update/ahnupctl.dll
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
HShield/Update/ahnupctl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
HShield/Update/autoup.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
HShield/Update/autoup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
ahnrpt.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
ahnrpt.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/AhnRpt.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/AhnRpt.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/PackAPI.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/PackAPI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
ehsvc.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
ehsvc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
HShield/Update/v3bz32.dll
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
HShield/Update/v3bz32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
HShield/V3Hunt.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
HShield/V3Hunt.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/AhnRpt.exe
-
Size
289KB
-
MD5
c41c2078d41317491b8fc6ce81b825ab
-
SHA1
003ef5d4f98e098ae222ab49dac2e79f616df206
-
SHA256
a2c51b0b8258d1cb4ab44318aead8c276d6b3f255bf26f3cdf2601e727cd6f6b
-
SHA512
08e384eadf37be1185c4a0643edf02099f2e1a0422affda8cf72dc185338c797166673d58dbc997ba8a402900d8b4410c6d670d66e3c6a4e41fed6eacb37576d
-
SSDEEP
6144:bHlRVuQey8WQ740ygZaTr3KdadW66OcAO+evBToSlpIKUr8oSSI:TlR4dy8WQzNw3/dW66jA+vBToWaNr8ou
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral23/memory/2132-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-1-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-2-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-3-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-4-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-5-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-7-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-8-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-9-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-10-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-11-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-12-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-13-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral23/memory/2132-14-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
Processes:
AhnRpt.exedescription ioc process Key opened \REGISTRY\MACHINE\Software\AhnLab\V3IS80 AhnRpt.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
AhnRpt.exedescription ioc process File opened (read-only) \??\Y: AhnRpt.exe File opened (read-only) \??\B: AhnRpt.exe File opened (read-only) \??\L: AhnRpt.exe File opened (read-only) \??\R: AhnRpt.exe File opened (read-only) \??\Q: AhnRpt.exe File opened (read-only) \??\U: AhnRpt.exe File opened (read-only) \??\Z: AhnRpt.exe File opened (read-only) \??\G: AhnRpt.exe File opened (read-only) \??\H: AhnRpt.exe File opened (read-only) \??\N: AhnRpt.exe File opened (read-only) \??\J: AhnRpt.exe File opened (read-only) \??\K: AhnRpt.exe File opened (read-only) \??\O: AhnRpt.exe File opened (read-only) \??\T: AhnRpt.exe File opened (read-only) \??\W: AhnRpt.exe File opened (read-only) \??\A: AhnRpt.exe File opened (read-only) \??\E: AhnRpt.exe File opened (read-only) \??\I: AhnRpt.exe File opened (read-only) \??\X: AhnRpt.exe File opened (read-only) \??\V: AhnRpt.exe File opened (read-only) \??\M: AhnRpt.exe File opened (read-only) \??\P: AhnRpt.exe File opened (read-only) \??\S: AhnRpt.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AhnRpt.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AhnRpt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AhnRpt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AhnRpt.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 AhnRpt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString AhnRpt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz AhnRpt.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 AhnRpt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AhnRpt.exepid process 2132 AhnRpt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AhnRpt.exedescription pid process Token: SeDebugPrivilege 2132 AhnRpt.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AhnRpt.exepid process 2132 AhnRpt.exe 2132 AhnRpt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AhnRpt.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AhnRpt.exe"1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2132